fix: make publish job install non-immutable on release branch

The publish job's first step ran `yarn install --immutable`, which fails on
a long-lived auto-incrementing release branch whose committed yarn.lock lags
the bumped package.json versions (stale @enclave-vm/*@npm:2.13.0 entries that
a clean install prunes). Immutable mode forbids the prune, so the job died at
setup before any version-bump/lock-sync step could run.

Set `install: "false"` on Setup Node + Yarn and add an explicit
`yarn install --no-immutable` step. The publish job is the source of truth for
versions and rewrites the lock every run, so it self-heals drift instead of
deadlocking. Immutable installs still guard normal PR/push CI.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: davidantoon

.github/workflows/publish-release.yml

@@ -76,6 +76,16 @@ jobs:
         with:
           node-version-file: ".nvmrc"
           registry-url: "https://registry.npmjs.org/"
+          # Do NOT run an immutable install here: this is a long-lived,
+          # auto-incrementing release branch. Its committed yarn.lock may lag the
+          # bumped package.json versions, and this job rewrites the lock anyway.
+          # An immutable install would fail before the version-bump/sync steps run.
+          install: "false"
+
+      - name: Install dependencies
+        # Mutable install: installs deps for nx/build AND self-heals any lockfile
+        # drift left by a previous release before this run bumps the version.
+        run: yarn install --no-immutable
 
       - name: Update npm CLI for trusted publishing
         run: npm install -g npm@latest